Operating system (OS) users often need to return their systems to earlier states to undo installation of unwanted applications/malware, among other things. To support this functionality, OSes have provided mechanisms, such as Microsoft® Windows's “System Restore,” that take snapshots of the file system and permit a user to revert the system to earlier points in time by restoring system files and settings using the snapshots. Windows users are permitted to create their own restore points, and the system also creates restore points automatically, e.g., before an application is installed.
Reversion mechanisms such as Windows's “System Restore” have a number of drawbacks. For instance, storing OS snapshots reduces the amount of disk space available to users, so the amount of storage allotted to snapshots may be limited to a certain percentage of available space (e.g., 20%). However, this tends to defeat the purpose of storing snapshots, as older snapshots are typically deleted when the limited storage space is exceeded, which means that the system can no longer be reverted to those snapshots. Further, reverting to a snapshot requires copying data from the snapshot back to a volume, which can take a long time (e.g., several minutes). The snapshot itself can also be infected by certain malware and advanced persistent threats (APTs) that then cannot be removed by reverting to the snapshot.